9213 matches found
Important: postgresql15
Issue Overview: Certain aggregate function calls receiving "unknown"-type arguments could disclose bytes of server memory from the end of the "unknown"-type value to the next zero byte. One typically gets an "unknown"-type value via a string literal having no type designation. We have not confirm...
CVE-2023-41780
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges...
The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, is related to deficiencies in access control. This vulnerability allows attackers to escalate their privileges.
The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of Hitachi Vantara NAS network storage systems, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.
The vulnerability of Hitachi Vantara NAS network storage systems is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Windows CLFS and five exploits used by ransomware operators
In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft. In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows...
Mozilla Thunderbird Security Advisories (MFSA2023-53, MFSA2023-56) - Mac OS X
Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...
The vulnerability of the User Post Gallery plugin of the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the User Post Gallery plugin in the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the IOKit component in the macOS operating system allows a hacker to intercept keyboard inputs.
The vulnerability of the IOKit component in the macOS operating system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to intercept keyboard inputs...
Google Chrome Security Vulnerability
Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in Google Chrome prior to version 114.0.5735.90, which stems from insufficient policy enforcement and allows a local attacker to bypass device policy restrictions by physically accessing the...
8220 Gang Exploiting Oracle WebLogic Server Vulnerability to Spread Malware
The threat actors associated with the 8220 Gang have been observed exploiting a high-severity flaw in Oracle WebLogic Server to propagate their malware. The security shortcoming is CVE-2020-14883 CVSS score: 7.2, a remote code execution bug that could be exploited by authenticated attackers to ta...
The vulnerability of the Windows Telephony Server server allows attackers to increase their privileges.
The vulnerability of the Windows Telephony Server server for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...
GHSA-45X7-PX36-X8W8 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
Summary Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server a...
The vulnerability of the USB 3.0 HUB driver in Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the USB 3.0 HUB driver for Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
The vulnerability of the Windows Hyper-V hardware virtualization system allows a perpetrator to escalate their privileges.
The vulnerability of the Windows Hyper-V hardware virtualization system is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to increase their privileges...
The vulnerability of the driver for auxiliary functions in Windows Sockets operating systems allows attackers to increase their privileges.
The vulnerability of the WinSock auxiliary function driver in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
Cybersecurity Industry Baffled by FBI’s Lack of Action on Ransomware Gang
Plus: Hackers reveal flaws in crypto wallets holding $1 billion, a massive breach of Danish electric utilities, and more...
OESA-2023-1921 jackson-databind security update
The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of servic...
Microsoft’s December 2023 Patch Tuesday Addresses One Zero-day Vulnerability
Summary: In the December Patch Tuesday release, Microsoft addressed a total of 42 CVEs, including one zero-day vulnerability. Within this range of vulnerabilities, the security update covered the typical spectrum of issues, including RCE flaws, concerns related to privilege escalation, spoofing,...
The vulnerability of the FortiOS operating systems and the FortiProxy proxy server, related to vulnerabilities in access control, allows attackers to bypass security restrictions.
The vulnerabilities of the FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks are related to deficiencies in access control. Exploiting these vulnerabilities allows a malicious actor to circumvent security restrictions by synchronizing publicly...
The vulnerability of the microprogramming software of the Ubiquiti Networks UniFi Dream Machine Pro, related to deficiencies in access control, allows intruders to circumvent domain restrictions.
The vulnerability of the microprogrammed software of the Ubiquiti Networks UniFi Dream Machine Pro relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass domain restrictions using specially created packages...